Privacy notice

Privacy notice, October 2026, in plain language. If we change this notice, for example when M‑Pesa or bank links arrive, we’ll tell you in the app and ask you to accept the new version.

This explains what myKesho collects, why, and your rights under Kenya’s Data Protection Act, 2019. The data controller is myKesho Limited. Contact us at [email protected].

What we collect

• About you: first name, family name, email address and what your kids call you. Your password and recovery code are stored only in a scrambled form (a secure hash) that nobody can read back.
• About each child: first and last name, birthday, username and PIN (from age 6), the avatar they pick, and what they do in the app: allowance, tasks, goals, asks, lessons and Kesho Stars. Children don’t need an email address.
• If you choose to add them: a photo of your child, and a nickname, school, class, likes and notes. Photos are kept separately from the rest of your family’s record, are seen only by parents in your family, and are deleted when you remove the photo, the child or your family. Your notes never reach your child’s phone.
• If you joined with another family’s invite link, that they invited you. They only see how many families joined, never who.
• If you share a child’s gift link: the name, amount and message a relative types in. The relative doesn’t need an account. The link shows only your child’s first name and what they call you. Only parents in your family see a gift until you confirm it; then your child sees the name and message too.
• Anything you or your child write in feedback.
• How the app and website are used, through Google Analytics: which screens are opened, roughly where from (country and city), the device and browser type, and moments like signing up or finishing a lesson. It never gets names, emails, usernames, PINs, amounts or anything typed into the app.
• We don’t collect precise location, ID numbers, or bank, card or M‑Pesa details.

Children’s data

• We only process a child’s data with the consent of their parent or legal guardian, which you give when you add them.
• We collect the least we need to run their pocket money and lessons. No ads, no selling data, no profiling children for marketing.
• Each child sees only their own money, tasks, goals and lessons. Brothers and sisters see just each other’s first name and avatar, so they can send each other money. Other families can never see your family.

Why we use it

• To run your family’s pocket money, tasks, goals, lessons and reminders.
• To send you account emails: a welcome, password-reset links you ask for, and invites to parents you add. Also short notes you can turn off in Account → Emails: when a child asks you something or a gift is on its way (at most one every few hours), and a Sunday note on each child’s week. No marketing emails unless you choose to get them.
• To improve myKesho: we look at overall numbers (sign-ups, lessons finished, how often families use the app) and your feedback to decide what to build next.
• To help you when something goes wrong, like a lock-out or a wrong amount. The small myKesho team can open your family’s record to sort it out, and can fix mistakes. They never see PINs, passwords or your private notes about a child. Every time they open a family or change something it’s logged with their name and the reason, and a change to a balance shows in your app as a correction. The team may keep short notes on your family (for example what you asked for help with), which stay with the team and are deleted with your family.
• To keep a permanent record of every money movement in your family, like a bank’s books, so balances can always be checked. This record is kept while your family is open and deleted with it.
• To answer Ask myKesho. Questions about your family are answered on your device from your own data. Open questions may go to an AI model run by our hosting provider, with a short summary that never includes PINs, passwords or email addresses.

Where it’s kept and who we share it with

• Your data is stored with our hosting provider, Cloudflare. Account emails are sent through our email provider. Both may process data outside Kenya under the safeguards the Act requires.
• Google Analytics (Google) counts how the app is used, as described above. Ads features, Google signals and data sharing with Google are all off. It sets cookies only if you choose “That’s fine” on the analytics card; otherwise it counts visits without cookies. Children are never asked, and on a child’s device it only uses cookies if a parent said yes on that phone. Analytics data is kept for 2 months.
• When you sign up, join a family, reset a password or send a gift through a gift link, Cloudflare Turnstile checks you’re a person and not a bot. It looks at your browser and connection, not at your family’s data.
• We don’t share it with anyone else, unless the law requires us to.

How long we keep it

While your family is open. When you delete your family, we delete its records straight away (feedback text is kept without your name or family). Password-reset links expire after 30 minutes, and sign-up codes after 10. If the app crashes, it sends us a short error report (what went wrong, the screen, your browser type and which family it happened in) so we can fix it. We keep those for 60 days.

Your rights

• To see the data we hold about you and your children: Account → Download our data.
• To correct it: change it in the app, or ask us.
• To delete it: Account → Delete our family, or remove a child.
• To withdraw consent for a child, or object to how we use data.
• To complain to the Office of the Data Protection Commissioner (ODPC).

Analytics cookies on this device

To use any of these, or for any question, email [email protected] or use Send feedback in the app. We reply within 7 days.